
DEPARTMENT OF DEFENSE 
UNITED STATES CYBER COMMAND 

9800 SAVAGE ROAD, SUITE 6171 
FORT GEORGE G MEADE, MARYLAND 20755 


Michael Martelle 


NOV 1 1 2018 


The National Security Archive 
Gelman Library, Suite 701 
2130 H Street, N.W. 
Washington, D.C. 20037 


Dear Mr. Martelle, 

Thank you for your September 21, 2018 Freedom of Information Act (FOIA) request for 
materials related to the Cyber Components Commander Conference on October 22, 2013. 

As the initial denial authority, I am partially denying portions of the document under 5 U.S.C. §§ 
552(b)(1) and (b)(3). The denied portions include classified national security information under 
the criteria of Executive Order 13526 (labeled as (b)(1)) and personally identifying information 
regarding personnel assigned to a sensitive unit exempt from disclosure under 10 U.S.C. § 130b 
(labeled as (b)(3)). U.S. Cyber Command is a sensitive unit. 

If you are not satisfied with our action on this request, you may file an administrative appeal 
within 90 calendar days from the date of this letter by U.S. mail or email. If you submit your 
appeal in writing, please address it to ODCMO, Director of Oversight and Compliance, 4800 
Mark Center Drive, ATTN: DPCLTD, FOIA Appeals, Mailbox #24, Alexandria VA 22350- 
1700. If you submit your appeal by email please send it to OSD.FQlA-APPEAL@mail.mil . 

All correspondence should reference U.S. Cyber Command case tracking number 19-R021. 

Additionally, you may contact the Office of Government Information Services (OG1S), which 
provides mediation services to help resolve disputes between FOIA requesters and Federal 
agencies. Contact information is 8601 Adelphi Road - OGIS, College Park. MD 20740-6001. 
OGIS may also be reached at oais@nara.gov . 202-741-5770, and 1-877-684-6448. 
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AGENDA 


Cyber Component Commanders Meeting 
22 October 2013 
1300-1630 


Protocol: 

(b)(3) 130b 

969-295Is or 

(b)(3) 130b 

969-2540s/ 

(b)(3) 130b 

CAG Rep: 


, 969-379Is / 





AS OF: 2 I OCT I 


Uniform: 

Military: duty uniform 
Civilian: Business 


Time Presentation Title and Presenter Location 

1300-1315 (U.^WWSHV'elcome and Opening Remarks DSCR 

GEN Keith B. Alexander, USA, CDR 
USCYBERCOM/DIRNSA/CHCSS 

1315-1345 (U/)iSttWlttyberspace Operations and Planning Update DSCR 

j(b)t3) 130b ~~| USAF, USCYBERCOM J3 

1345-1400 (UAfitfifi) CMF Training and Exercises Update DSCR 

N 3)130b | USAF, USCYBERCOM J7 

1400-1410 (ummm^Break 

1410-1530 (UABSiift^Component Commander Updates on CMF/JFF10 DSCR 

Builds and Service-Specific Shutdown/Sequestration Issues 

1530-1615 (UAP#W#Component Commander Discussions DSCR 

Topics Include: 

fb)(i) Sec 1.7(e) 

-Impact of Shutdown on Operations and CMF Builds 


-Joint Cyber Warrior Education Program (JCWEP) Feedback 

1615- i 630 (U£B®W#^Closing Remarks DSCR 

GEN Keith B. Alexander, USA, CDR 
USCYBERCOM/DIRNSA/CHCSS 

1630 Depart 
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Cyber Mission Force 
Training & Cyber Flag 
Update 


22 October 2013 


(b)(3) 130b 


Director of Joint Exercises and Training (J7), USCYBERCOM 

The overall classification of this briefing is: UI\ICLASSIFIED/j4^W&* 


UNCLASSIFIEI 







UNCLASSIFIED 


Shutdown Impact on CMF Training 

Furlough Impact on 1 st Qtr FY14 CMF Training Schedule: 

- 17x FY13-funded courses delayed minimum or 21 days (impacts "323 students & 219,640hrs lost) 

• Re-starts beginning 21 Oct...(rescheduled classes will retain original rosters) 

• Courses: CYBR3800 /CYEC2200/ NET04012 /CRSK1000/ CYBR1010 /NETA1030 /COMPllOO/ 
CYBR3100 /COMP2050/ NETA2008 

- 8x FY13-funded courses require additional funding to be rescheduled (impacts "166 students & 

53,120hrs ) 

• Earliest can resume 28 Oct, if original students are available to attend training-otherwise 
minimum of 28 day delay to restart (Still verifying original student availability) 

• Contracting Officer working with Vendors to assess specific contract penalties/costs for 
rescheduling 

• Courses: CYBR1200/CYBR1040/NETW3006 /CYBR2005 /NET04000 /NETW1002 /NETW3004 
/NET04000 

- 44x FY14-funded courses now delayed until FY14 funds received (impacts "913 students & 
5,384hrs) 

- JCWEP was delayed 5 days and the CYBR2005 (Advanced Security Essentials -5 days) block 
postponed 

- 25x students delayed Joint Network Attack Course (JNAC) by 2 weeks 

• Rescheduling 15 Oct class with 28 Oct start (25 CMF attendees) forces 19 Nov class to require 
swing shift and will run second shift through 22 Nov-goes back to normal day shift 25 Nov 

- 19x students for one full Mission Commanders Course lost opportunity (2 week course & 
l,520hrs) due to shift in schedule and conflicting instructor commitments 

- Shutdown potentially impacting FY14 Battle Rostered names-currently only 66 names against 
FY14 teams and minimal training requirements scheduled 


UNCLASSIFIED 
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UNCLASSIFIED 


I® Cyber Flag 14-1 Update 

- BLUF: "Reduced Scope" Exercise--20% redux in attendees and schedule...canx'd DV Day 6 Nov 

- Changes to footprint ~72pax of 490 (~20%): Focused on keeping Blue & OPFOR intact 

- Keep # of teams as planned (no cuts to on-keyboard blue players, just some "overhead" trimming) 

- Cut White Cell by 50 (~40% reduction) 

Cut Assessors by 12 

- Cut Support staff by 10 

- Timeline: Cutting 4 days off the front end of schedule (Execution now 1-7 Nov) 

- 13 Oct - Advanced Team/Prep depart 

14 Oct - Projected equipment arrival date 

- 14-29 Oct - Local Network Build/Integration/Testing/Final Snapshots 

- 29 Oct - Main Body Travel 

30 Oct - Registration/Academics 

- 31 Oct - Range Familiarization/Dress Rehearsal 

- 1-7 Nov - Execution/Vulnerability windows (no intermission/mission planning at halfway point) 

- 8 Nov - Hotwash SVTC (TBD) 

- As of 22 Oct: 

- 29 Personnel Advanced Team on site performing setup/test 

Equipment successfully shipped/received - still awaiting 2GB TACLANEs from JIOR (Norfolk) ETA 
Wednesday, 23 Oct 

- Local Network/Exercise build 90% complete external connectivity testing begins 23 Oct 
Showstoppers: None 
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Questions/Discussion? 


UNCLASSIFIED 
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Back Up Slides 
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Training Pipeline and Training 

Status Templates 
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POC and Reference Links 


• J7 POCs 


- NMTs/NSTs/CSTsr^^ 

— CMTs !b)(3)130b 


- NMTs/CPTs |bK3|130b 

— cPTs (b)(3)130b 



• ADET Scheduling POCs 


Other refrences on NSANet: 
•“Go ELM” for pre-requisites 
•“Go ITP” 


|(b){3) 130b 



|(b)(3) 130b 

(CYEC/NETW/NETO/COMP/CYBR) 

_ (b;(3)' 30:; 

(NETA/CRSK/RPTG/ANSK) 

_ j{b)(3) 130b 

(NETO3200/CYBR3800) 


• J7 Portal - Standards, workrole pipelines, Cyber Development Plans, JQRs, etc... 

http://intelshare.intelink.ic.gov/sites/uscybercom/i7/CMF Training/Training/Form 

s/Allltems.aspx 


• ADET Portal - Training Schedule, Service Requirements Spreadsheet, etc... 

https://ls.icrf.nsa.ic.gov/adet/org/college- 

crvptologv/cno/cmfsite/CMF%20Training%20Seat%20Requirements/Forms/Alllt 
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CMF Training Challenges/Mitigations 


Challenges 

Mitigations 

• Course Requirements Scheduling & Throughput 

* Training Pipeline Stabilization 

* Grandfathering experience/training 

* Intermediate Cyber Core (ICC) for CPT 

* JACWC (CMF leadership training) 

* Red/Blue/Hunt Methodologies Training (for 
non-National CPTs) 

• Training products locked 17 Jul and posted to CMF Training Portal 

• Individual Training Equivalency Board and Course Equivalency 
processes easing demands on training pipeline 

• Alternate ICC (AL.TICC) and AL.TICC Cohorts built/offered along with 

Service course equivalency process (e.g. 24th AF's INWT) 

• Approved PACWC variant/pilot and priority for CMF in Oct & FY14 
classes 

• Working with J34/5 to identify specific methodology requirements; 
training development effort will follow 


• Workrole/Functional Job Qualification • JQR team completed writing/staffing of all 28 CPT JQRs 

Requirements (JQRs) . Qyjp jqr jasKORD (ig Sep) for remainder of CMF non-CPT positions 


• Developed IOO and Auditor JQRs for staffing to alleviate sponsorship 


• Mission Assignment/Alignment Training Impacts 

• Collective training standards 

• Tasks, Conditions & Standards identified 

• Team Certification 

• JF HQ Certification 

• CNMF HQ Certification 

• Career planning and retention 

• Funding 

• Projected RMD funding estimate 

• TDY Funding 


Working in concert with J2/J3/CNMF/NSA on Mission Alignment Board 
process to ensure ability to attend sponsorship-required training 

Build of Training & Readiness (T&R) Manual captures CMF-specific 
training standards for individual thru collective training-est Feb 14 

Cyber Knight/Guard/Flag w/Svc Cyber Components inform T&R Manual 
task, conditions, and standards 

CFIST developing Joint Mission Essential Tasks (JMETs) for JF HQ 

Expanding "Cyber" series of events in FY14 to inform Service 
presentation of forces 

Work force development working group working with services on 
identifying critical work roles for retention 

RMD funded, but "fragile" based on fiscal environment 

Mitigated by leveraging 4 National Cryptologic System (NCS) centers- 
USCYBERCOM TDY funding provided by exception for non-NCS courses 
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CMF Training History...getting to glideslope 
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I® CMF Training "Template" 

• Training Template is a Leadership Tool to help track each individual 
teams training progress 

• Will help forecast future training requirements (i.e. people, $, 
schedule) 

• Aggregated data will answer the "glide slope" question 

(b)(1) Sec 1.7(e), (b)(3) 130b 
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I# USCYBERCOM 2013 Exercises & Wargame 



JAN FEB MAR 




19-20IPQ/ ADET ▼ 22-26 Execution - Ft Meade^ 

18-22-AREmiHM- 



JUL AUG SEP OCT 


425-29-FLT Element #1 

$12-13 MPC/ADET 

V 1 ?fHh - IRA release 



<*-♦ 


-13 Execution - Ft Meade 


NOV 


HSU 


$ 3-6 FPC / Smart Ctr 

$ 23-25 CDC - Andrews AFB $ 2-4 MPC / ADET ) 24 lh - ISA n 

$"”$13-26 Execution 

A 26- 28 IPC / ADET (Ft Meade) 

* ^ 1-30 Mini-Guards 


$26-29 AAR/C DC/Smart Ctr 






$ Service VM Reqs 


>16-18 IPC 
Ft, Meade 


♦ TBD Network Range Sync 

c 


Ft. Meade 


^ 4-6 PLANEX/Ft, Meade 

♦ 25-27 MPC/Ft. Meade a 

V 20-22 FPC / F 

$28 MSEL Sync/Ft. Meade 


10-13 

1st - ISA release $ AAR/CDC 

Smart Ctr 

Meade 


(DISA, AFCYBER, MAI 
FLTCYBER, Coalition) 


F-ORCYBER, 

2 Events Each 




$3-7 Working-Seminar/s Andrews Smart Center 



19-23 Execution / Ar trews Smart Center 
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$ Execution $ Conference ) ISA release date CG Mini Guards Spin-Ups $ Persistent XNET Dev 












































Cyber Component 
Commanders Meeting 

(22 October 2013) 
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The overall classification of this briefing is: 


, _ (b)(3) 130b 

Classified By 

Derived From: USCYBERCCnVTSCXr 
Dated:20111011 
AND 

Derived From: NSA/CSSM 1-52 
Dated:20070108 
Declassify On: 20380901 
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Cyber Component 
Commanders Meeting 

(22 October 2013) 

Cyberspace Operations 


ft* ™ 


USCYBERCOM J3 


The overall classification of this briefing is: 


, 0 1(b)(3) 130b 

Classified By: 

Derived From: USCYBERCOM SCG 
Dated:20111011 
AND 

Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20380901 
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(U) Operations & Planning Update 








Cyber Mission Force: FY13 - FY14 Build 


(b)(1) Sec 
1.4(a) 


usa = mm usaf = mm usmc = m i usn = mm 



Combat Mission Teams I Combat Support Teams I CCMD Cyber Protection Teams I Service Cyber Protection Teams 
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Current State - Intelligence Centric Platform 
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P tanners, 

Targeteers, Linguists, 
TOPIs, R&T Analysts, 
Developers, Testers, 
Fires Support 
Personnel, 

Etc. 


Databases, Test Labs, 
Development Labs... 
and More Databases, 












Future Strategy 
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Databases, Test Labs, 
Development Labs 
etc. 


Planners, 

Targe tears, Linguists, 
TOPIs, R&T Analysts, 
Developers, Testers, 
Fires Support 
Personnel, 

Etc. 
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Commanders Meeting 
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Cyber Mission Force Training and 
Cyber Flag Update 


(b)(3) 130b 


USCYBERCOM 17 


The overall classification of this briefing is: UNCLASSIFIED//*»R^fe4eUU_UfittftU^ 


Classified By: ^ 3 ^ 
Derived From: USCYBERCOM S US 


Dated:20111011 
AND 

Derived From: NSA/CSSM 1-52 
Dated:20070108 
Declassify On: 20380901 
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I® Shutdown Impact on CMF Training 

Furlough Impact on 1 st Qtr FY14 CMF Training Schedule: 

- 17x FY13-funded courses delayed minimum or 21 days (impacts ~323 students & 219,640hrs lost) 

• Re-starts beginning 21 Oct...(rescheduled classes will retain original rosters) 

• Courses: CYBR3800 /CYEC2200/ NETO4012 /CRSK1000/ CYBR1010 /NETA1030 /COMPllOO/ 
CYBR3100 /COMP2050/ NETA2008 

- 8x FY13-funded courses require additional funding to be rescheduled (impacts ~166 students & 
53,120hrs ) 

• Earliest can resume 28 Oct, if original students are available to attend training-otherwise 
minimum of 28 day delay to restart (Still verifying original student availability) 

• Contracting Officer working with Vendors to assess specific contract penalties/costs for 
rescheduling 

• Courses: CYBR1200/CYBR1040/NETW3006 /CYBR2005 /NET04000 /NETW1002 /NETW3004 
/NET04000 

- 44x FY14-funded courses now delayed until FY14 funds received (impacts ~913 students & 
1,606,880 hrs) 

- JCWEP was delayed 5 days and the CYBR2005 (Advanced Security Essentials -5 days) block 
postponed 

- 25x students delayed Joint Network Attack Course (JNAC) by 2 weeks 

• Rescheduling 15 Oct class with 28 Oct start (25 CMF attendees) forces 19 Nov class to require 
swing shift and will run second shift through 22 Nov—goes back to normal day shift 25 Nov 

- 19x students for one full Mission Commanders Course lost opportunity (2 week course & 
l,520hrs) due to shift in schedule and conflicting instructor commitments 

- Shutdown potentially impacting FY14 Battle Rostered names-currently only 66 names against 
FY14 teams and minimal training requirements scheduled 


UNCLASSIFIED 


8 


UNCLASSIFIED 


Cyber Flag 14-1 Update 

- BLUF: "Reduced Scope" Exercise—20% redux in attendees and schedule...canx'd DV Day 6 Nov 

- Changes to footprint ~72pax of 490 (~20%): Focused on keeping Blue & OPFOR intact 

Keep # of teams as planned (no cuts to on-keyboard blue players, just some "overhead" trimming) 

- Cut White Cell by 50 (~40% reduction) 

- Cut Assessors by 12 

- Cut Support staff by 10 

- Timeline: Cutting 4 days off the front end of schedule (Execution now 1-7 Nov) 

13 Oct - Advanced Team/Prep depart 

14 Oct - Projected equipment arrival date 

14-29 Oct - Local Network Build/Integration/Testing/Final Snapshots 

- 29 Oct - Main Body Travel 

- 30 Oct - Registration/Academics 

- 31 Oct - Range Familiarization/Dress Rehearsal 

1-7 Nov - Execution/Vulnerability windows (no intermission/mission planning at halfway point) 

- 8 Nov - Hotwash SVTC (TBD) 

- As of 22 Oct: 

- 29 Personnel Advanced Team on site performing setup/test 

Equipment successfully shipped/received— still awaiting 2GB TACLANEs from JIOR (Norfolk) ETA 
Wednesday, 23 Oct 

Local Network/Exercise build 90% complete external connectivity testing begins 23 Oct 
Showstoppers: None 
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Questions/Discussion? 
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Cyber Component 
Commanders Meeting 

(22 October 2013) 


Next Meeting: 

22 November 2013, 0830-1300 

The overall classification of this briefing 


Classified By:™ 3 ) 130b 
Derived From: USCYBERCOM'SCG - 
Dated:20111011 


AND 

Derived From: NSA/CSSM 1-52 
Dated:20070108 
Declassify On: 20380901 
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